If you collect any information about visitors (name, emails address, etc) then you should have a policy telling them what you collect, how you use it and how they can remove this information from your database. Even if it's a newsletter sign up through a third party such as MailChimp, you should still have a policy of your own.
You likely don't see them on smaller sites because either the business, or their designer/developer didn't bother to create/understand they need a policy.
As for a cookie policy, they're pointless but the EU says we need them so you should have one. Chances are your site is using cookies and you didn't even know it, especially if you use something like Google fonts.
The ICO keeps changing it's mind about whether we need to use an (annoying) banner to inform people about them or not, but I tend to use one just in case.
